Loi du 5 mai 2026 (NIS 2 Luxembourg) Copilot

It is the Luxembourg law that transposes the EU NIS 2 Directive (2022/2555), adopted as bill no. 8364 and published in Mémorial A no. 225 on 6 May 2026. It has applied since 10 May 2026 and repeals the law of 28 May 2019 that transposed the first NIS Directive. It sets who is in scope, the risk-management and board duties, the incident reporting steps, and the supervisory and sanctioning powers of the ILR and the CSSF.

Organisations of a type listed in Annex I (highly critical sectors) or Annex II (other critical sectors) that are at least medium-sized and active in the EU: energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, managed ICT services, public administration, space, postal services, waste, chemicals, food, manufacturing, digital providers and research. Some are in scope whatever their size, including public electronic communications providers, trust service providers, TLD registries and DNS providers, domain name registration services, critical entities under Luxembourg's critical entities law of the same date, and public administration entities, a category that leaves out the courts, the Chamber of Deputies and the Banque centrale du Luxembourg. Large Annex I entities, qualified trust service providers, TLD registries, DNS providers, medium-sized public electronic communications providers, public administration entities, critical entities, former operators of essential services and entities the authority designates as essential are essential entities; the other Annex I and II entities in scope are important entities, and domain name registration services are listed and regulated separately. Most entities fall under Luxembourg's jurisdiction when they are established in Luxembourg. Public electronic communications providers fall under the country where they provide their services, public administration entities under the State that set them up, and DNS providers, TLD registries, domain name registration services, cloud, data centre, content delivery and managed (security) service providers, online marketplaces, search engines and social networks follow their main EU establishment (article 16). The registration deadline was 10 July 2026. An entity that missed it should register now: it is still bound by the Law and can be fined under article 25.

For a significant incident, article 14 sets a clock that starts when you become aware of it: a first alert within 24 hours, a fuller notification with your initial assessment within 72 hours, an interim update whenever the CSIRT or the authority asks, and a final report one month after the 72-hour notification. If the incident is still running at that point, you send a progress report instead and the final report one month after the incident is dealt with. A trust service provider notifies within 24 hours when its trust services are affected. Reports go to the competent authority, which forwards them to the CSIRT and to the single point of contact, the High Commission for National Protection (HCPN). Entities supervised by the ILR file through its SERIMA online form. Where a sector act such as DORA applies to you and its measures or reporting rules have at least equivalent effect, the matching provisions of the Law do not apply to you (article 1(8)).

It reads your situation against the Luxembourg texts rather than the directive alone: which annex and category you fall into, whether the ILR or the CSSF supervises you, what an ILR-supervised essential entity files each year, and how the article 12 measure areas line up with the controls you already run under ISO 27001. Treat the output as a draft for your own review. The Copilot does not register you or notify incidents for you, and your supervisor decides whether your measures are adequate.